[jira] [Commented] (HDDS-4944) Multi-Tenant Support in Ozone

["Marton Elek (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HDDS-4944?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17305975#comment-17305975 ] 

Marton Elek commented on HDDS-4944:
-----------------------------------

Thank you very much to upload the documents [~ppogde]. I think it's a very interesting and important factor for Ozone.

I have a lot of comments and I uploaded them as a PDF (See 'Ozone, Multi-tenancy, S3, Kerberos....pdf' from the attachments) because the comments were quite long.

I will try to summarize the most important questions here, but please read the full document for the context (there are questions there which are not here).
 
1. First, I really like the visualization of the documents. Unfortunately without the visualization we got very short text which explains them. Charts are very detailed, and I think we should add significant more information to explain them in written form.

2. For example, the role of the Ranger integration is not clear for me. (What about non-ranger users? Will we implement some group/role management in the OM?)

3. The other part which is missing (for me) is comparing the suggested solution with alternatives which are already discussed earlier. Like: a.) limiting the scope of our user management and focusing on the integration with external systems (OIDC, AWS STS,...) b.) providing bucket-namespace isolation purely with different s3g instances 

4. I would also prefer to separate the question of multi-tenancy from the pure, non-kerberos based user management. They are orthogonal question and I suggest to separate them.

5. And write more about the long-term plans and how the solutions fit in them (like kerberos-free Ozone cluster management, what would it mean for this solution).
 
Summary: 

Thanks for starting the discussion here, and the great work. I think we need more (public) discussion and an improved design before the implementation (which may be started in https://github.com/apache/ozone/pull/2059) 



> Multi-Tenant Support in Ozone
> -----------------------------
>
>                 Key: HDDS-4944
>                 URL: https://issues.apache.org/jira/browse/HDDS-4944
>             Project: Apache Ozone
>          Issue Type: New Feature
>          Components: Ozone CLI, Ozone Datanode, Ozone Manager, Ozone Recon, S3, SCM, Security
>    Affects Versions: 1.2.0
>            Reporter: Prashant Pogde
>            Assignee: Prashant Pogde
>            Priority: Major
>              Labels: pull-request-available
>         Attachments: Apache-S3-compatible-Multi-Tenant-Ozone-short.pdf.gz, Ozone, Multi-tenancy, S3, Kerberos....pdf, UseCaseAWSCompatibility.pdf, UseCaseCephCompatibility.pdf, UseCaseConfigureMultiTenancy.png, UseCaseCurrentOzoneS3BackwardCompatibility.pdf, VariousActorsInteractions.png
>
>
> This Jira will be used to track a new feature for Multi-Tenant support in Ozone. Initially Multi-Tenant feature would be limited to ozone-users accessing Ozone over S3 interface.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org